sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-06 13:39:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

Build VNC auth for peers on the component network map path

Browse Source
This commit is contained in:
Viktor Liu
2026-07-30 11:01:35 +02:00
parent 05a75d80eb
commit 0e2bd094bb
4 changed files with 131 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
management/internals/shared/grpc/conversion.go
+3 -39
View File
@@ -2,7 +2,6 @@ package grpc
import (
"context"
"encoding/base64"
"fmt"
"net/netip"
"net/url"
@@ -10,8 +9,6 @@ import (
"time"
"github.com/hashicorp/go-version"
log "github.com/sirupsen/logrus"
nbversion "github.com/netbirdio/netbird/version"
"google.golang.org/protobuf/types/known/timestamppb"
@@ -27,7 +24,6 @@ import (
"github.com/netbirdio/netbird/shared/management/networkmap"
"github.com/netbirdio/netbird/shared/management/proto"
"github.com/netbirdio/netbird/shared/netiputil"
"github.com/netbirdio/netbird/shared/sshauth"
)
const (
@@ -217,16 +213,16 @@ func ToSyncResponse(ctx context.Context, config *nbconfig.Config, httpConfig *nb
response.NetworkMap.SshAuth = &proto.SSHAuth{AuthorizedUsers: hashedUsers, MachineUsers: machineUsers, UserIDClaim: userIDClaim}
}
if networkMap.VNCAuthorizedUsers != nil || len(networkMap.VNCSessionPubKeys) > 0 {
if len(networkMap.VNCAuthorizedUsers) > 0 || len(networkMap.VNCSessionPubKeys) > 0 {
var hashedUsers [][]byte
var machineUsers map[string]*proto.MachineUserIndexes
if networkMap.VNCAuthorizedUsers != nil {
if len(networkMap.VNCAuthorizedUsers) > 0 {
hashedUsers, machineUsers = networkmap.BuildAuthorizedUsersProto(ctx, networkMap.VNCAuthorizedUsers)
}
response.NetworkMap.VncAuth = &proto.VNCAuth{
AuthorizedUsers: hashedUsers,
MachineUsers: machineUsers,
SessionPubKeys: buildSessionPubKeysProto(ctx, networkMap.VNCSessionPubKeys),
SessionPubKeys: networkmap.BuildSessionPubKeysProto(ctx, networkMap.VNCSessionPubKeys),
}
}
@@ -243,38 +239,6 @@ func ToSyncResponse(ctx context.Context, config *nbconfig.Config, httpConfig *nb
return response
}
// buildSessionPubKeysProto decodes base64 X25519 session pubkeys and
// hashes the user IDs they belong to, emitting the proto entries the
// daemon's authorizer indexes by pubkey.
func buildSessionPubKeysProto(ctx context.Context, in []types.VNCSessionPubKey) []*proto.SessionPubKey {
if len(in) == 0 {
return nil
}
out := make([]*proto.SessionPubKey, 0, len(in))
for _, e := range in {
pub, err := base64.StdEncoding.DecodeString(e.PubKey)
if err != nil {
log.WithContext(ctx).Warnf("decode VNC session pubkey: %v", err)
continue
}
if len(pub) != 32 {
log.WithContext(ctx).Warnf("VNC session pubkey wrong length: %d", len(pub))
continue
}
hash, err := sshauth.HashUserID(e.UserID)
if err != nil {
log.WithContext(ctx).Warnf("hash VNC session user id: %v", err)
continue
}
out = append(out, &proto.SessionPubKey{
PubKey: pub,
UserIdHash: hash[:],
DisplayName: e.DisplayName,
})
}
return out
}
// encodeSessionExpiresAt encodes a server-side deadline into the 3-state wire
// representation used on LoginResponse, SyncResponse and
// ExtendAuthSessionResponse. See the proto comments on those messages.